How to use the inql.burp_ext.CustomScanIssue function in inql

To help you get started, we’ve selected a few inql examples, based on popular ways it is used in public projects.

Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.

github doyensec / graph-ql / inql / burp_ext.py View on Github external
"The website is using GraphQL Technology!<br><br>"
                    "GraphQL is an open-source data query and manipulation language for APIs, and a runtime for fulfilling queries with existing data. GraphQL was developed internally by Facebook in 2012 before being publicly released in 2015.<br><br>"
                    "It provides an efficient, powerful and flexible approach to developing web APIs, and has been compared and contrasted with REST and other web service architectures. It allows clients to define the structure of the data required, and exactly the same structure of the data is returned from the server, therefore preventing excessively large amounts of data from being returned, but this has implications for how effective web caching of query results can be. The flexibility and richness of the query language also adds complexity that may not be worthwhile for simple APIs. It consists of a type system, query language and execution semantics, static validation, and type introspection.<br><br>"
                    "GraphQL supports reading, writing (mutating) and subscribing to changes to data (realtime updates).",
                    "Information", "Firm", "Not posing any imminent security risk.",
                    "<ul><li><a href="https://graphql.org/">GraphQL</a></li></ul>",
                    ""
                )])

        for check in CONSOLE_CHECKS:
            # look for matches of our passive check grep string
            matches = self._get_matches(baseRequestResponse.getResponse(), bytearray(check))
            if len(matches) != 0:
                # report the issue
                # httpService, url, httpMessages, name, detail, severity, confidence, issue background, remediation background, remediation details
                issues.extend([CustomScanIssue(
                    baseRequestResponse.getHttpService(),
                    self._helpers.analyzeRequest(baseRequestResponse).getUrl(),
                    [self._callbacks.applyMarkers(baseRequestResponse, None, matches)],
                    "Exposed GraphQL Development Console",
                    "GraphQL is a query language for APIs and a runtime for fulfilling queries with existing data.<br><br>"
                    "<b>GraphiQL/GraphQL Playground</b> are in-browser tools for writing, validating, and testing GraphQL queries.<br><br>"
                    "The response contains the following string: <b>%s</b>." % check,
                    "Low", "Firm", "Not posing any imminent security risk.",
                    "<ul>"
                    "<li><a href="https://graphql.org/">GraphQL</a></li>"
                    "<li><a href="https://github.com/graphql/graphiql">GraphiQL</a></li>"
                    "<li><a href="https://github.com/prisma/graphql-playground">GraphQL Playground</a></li>"
                    "</ul>",
                    "Remove the GraphQL development console from web-application in a production stage.<br><br>"
                    "Disable GraphiQL<br>"
                    "<pre>if (process.env.NODE_ENV === 'development') {</pre><br>"
github doyensec / graph-ql / inql / burp_ext.py View on Github external
def doPassiveScan(self, baseRequestResponse):
        issues = []
        for check in TECH_CHECKS:
            # look for matches of our passive check grep string
            matches = self._get_matches(baseRequestResponse.getResponse(), bytearray(check))
            if len(matches) != 0:
                # report the issue
                # httpService, url, httpMessages, name, detail, severity, confidence, issue background, remediation background, remediation details
                issues.extend([CustomScanIssue(
                    baseRequestResponse.getHttpService(),
                    self._helpers.analyzeRequest(baseRequestResponse).getUrl(),
                    [self._callbacks.applyMarkers(baseRequestResponse, None, matches)],
                    "GraphQL Technology",
                    "The website is using GraphQL Technology!<br><br>"
                    "GraphQL is an open-source data query and manipulation language for APIs, and a runtime for fulfilling queries with existing data. GraphQL was developed internally by Facebook in 2012 before being publicly released in 2015.<br><br>"
                    "It provides an efficient, powerful and flexible approach to developing web APIs, and has been compared and contrasted with REST and other web service architectures. It allows clients to define the structure of the data required, and exactly the same structure of the data is returned from the server, therefore preventing excessively large amounts of data from being returned, but this has implications for how effective web caching of query results can be. The flexibility and richness of the query language also adds complexity that may not be worthwhile for simple APIs. It consists of a type system, query language and execution semantics, static validation, and type introspection.<br><br>"
                    "GraphQL supports reading, writing (mutating) and subscribing to changes to data (realtime updates).",
                    "Information", "Firm", "Not posing any imminent security risk.",
                    "<ul><li><a href="https://graphql.org/">GraphQL</a></li></ul>",
                    ""
                )])

        for check in CONSOLE_CHECKS:
            # look for matches of our passive check grep string
            matches = self._get_matches(baseRequestResponse.getResponse(), bytearray(check))
github doyensec / graph-ql / inql / burp_ext.py View on Github external
"The website is using GraphQL Technology!<br><br>"
                        "GraphQL is an open-source data query and manipulation language for APIs, and a runtime for fulfilling queries with existing data. GraphQL was developed internally by Facebook in 2012 before being publicly released in 2015.<br><br>"
                        "It provides an efficient, powerful and flexible approach to developing web APIs, and has been compared and contrasted with REST and other web service architectures. It allows clients to define the structure of the data required, and exactly the same structure of the data is returned from the server, therefore preventing excessively large amounts of data from being returned, but this has implications for how effective web caching of query results can be. The flexibility and richness of the query language also adds complexity that may not be worthwhile for simple APIs. It consists of a type system, query language and execution semantics, static validation, and type introspection.<br><br>"
                        "GraphQL supports reading, writing (mutating) and subscribing to changes to data (realtime updates).",
                        "Information", "Firm", "Not posing any imminent security risk.",
                        "<ul><li><a href="https://graphql.org/">GraphQL</a></li></ul>",
                        ""
                    )])

            for check in CONSOLE_CHECKS:
                # look for matches of our passive check grep string
                matches = self._get_matches(result.getResponse(), bytearray(check))
                if len(matches) != 0:
                    # report the issue
                    # httpService, url, httpMessages, name, detail, severity, confidence, issue background, remediation background, remediation details
                    issues.extend([CustomScanIssue(
                        result.getHttpService(),
                        self._helpers.analyzeRequest(result).getUrl(),
                        [self._callbacks.applyMarkers(result, None, matches)],
                        "Exposed GraphQL Development Console",
                        "GraphQL is a query language for APIs and a runtime for fulfilling queries with existing data.<br><br>"
                        "<b>GraphiQL/GraphQL Playground</b> are in-browser tools for writing, validating, and testing GraphQL queries.<br><br>"
                        "The response contains the following string: <b>%s</b>." % check,
                        "Low", "Firm", "Not posing any imminent security risk.",
                        "<ul>"
                        "<li><a href="https://graphql.org/">GraphQL</a></li>"
                        "<li><a href="https://github.com/graphql/graphiql">GraphiQL</a></li>"
                        "<li><a href="https://github.com/prisma/graphql-playground">GraphQL Playground</a></li>"
                        "</ul>",
                        "Remove the GraphQL development console from web-application in a production stage.<br><br>"
                        "Disable GraphiQL<br>"
                        "<pre>if (process.env.NODE_ENV === 'development') {</pre><br>"
github doyensec / graph-ql / inql / burp_ext.py View on Github external
def doActiveScan(self, baseRequestResponse, insertionPoint):
        issues = []
        # will request the URLS, passive scanner will do the grep and match
        for url in URLS:
            path = self._callbacks.getHelpers().analyzeRequest(baseRequestResponse).getUrl().getPath()
            # this thing replace the path inside the old bytearray for the new request
            newReq = self._callbacks.getHelpers().bytesToString(baseRequestResponse.getRequest()).replace(path, url,
                                                                                                          1)
            result = self._callbacks.makeHttpRequest(baseRequestResponse.getHttpService(), newReq)
            for check in TECH_CHECKS:
                # look for matches of our passive check grep string
                matches = self._get_matches(result.getResponse(), bytearray(check))
                if len(matches) != 0:
                    # report the issue
                    # httpService, url, httpMessages, name, detail, severity, confidence, issue background, remediation background, remediation details
                    issues.extend([CustomScanIssue(
                        result.getHttpService(),
                        self._helpers.analyzeRequest(result).getUrl(),
                        [self._callbacks.applyMarkers(result, None, matches)],
                        "GraphQL Technology",
                        "The website is using GraphQL Technology!<br><br>"
                        "GraphQL is an open-source data query and manipulation language for APIs, and a runtime for fulfilling queries with existing data. GraphQL was developed internally by Facebook in 2012 before being publicly released in 2015.<br><br>"
                        "It provides an efficient, powerful and flexible approach to developing web APIs, and has been compared and contrasted with REST and other web service architectures. It allows clients to define the structure of the data required, and exactly the same structure of the data is returned from the server, therefore preventing excessively large amounts of data from being returned, but this has implications for how effective web caching of query results can be. The flexibility and richness of the query language also adds complexity that may not be worthwhile for simple APIs. It consists of a type system, query language and execution semantics, static validation, and type introspection.<br><br>"
                        "GraphQL supports reading, writing (mutating) and subscribing to changes to data (realtime updates).",
                        "Information", "Firm", "Not posing any imminent security risk.",
                        "<ul><li><a href="https://graphql.org/">GraphQL</a></li></ul>",
                        ""
                    )])

            for check in CONSOLE_CHECKS:
                # look for matches of our passive check grep string
                matches = self._get_matches(result.getResponse(), bytearray(check))